This flaw exists in the Bluetooth L2CAP layer of the Linux kernel, which handles socket callbacks for incoming connections. A missing NULL guard in the function that creates new connection callbacks could allow an attacker to trigger a kernel null‑pointer dereference, potentially causing a fatal crash and resulting in a denial‑of‑service condition. The bug was fixed by adding the same safety check that already exists in related callbacks, but prior to the patch it could be exploited by sending malformed Bluetooth packets to the vulnerable endpoint.

The defect impacts any Linux kernel that contains the vulnerable Bluetooth stack. No specific kernel versions or release branches are listed, so all installations that might still run an affected kernel should be considered at risk until the fix is applied.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerable code runs in kernel space, and the attacker could trigger it remotely by sending crafted L2CAP frames over Bluetooth, making the potential impact high if the flaw remains unpatched. The issue is likely to be identified in logs as a kernel OOPS or panic event, indicating a full denial‑of‑service takeover of the affected host.